CVEs published in May 2022
2,612 vulnerabilities, 425 critical, 9 exploited.
- 74cms 74cmsse74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter...7.5 High
- 74cms 74cmsse74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component ...7.5 High
- piwigoPiwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.8.8 High
- mini-xml project mini-xmlA stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the...7.5 High
- mini-xml project mini-xmlA memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service.7.5 High
- tinytoml project tinytomlThere is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS.6.5 Medium
- qnap systems inc. proxy server, qnap nas proxy server +1 moreCSRF Bypass in Proxy Server5.3 Medium
- angular, angularjs +1 moreAngular Comment cross site scripting3.5 Low
wiresharkOSS-FuzzStack-use-after-return in conversation_match_element_listNo scorexstreamOSS-FuzzUncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpecNo score- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreA crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in...7.8 High
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreA crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G...7.8 High
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreAn integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G...6.7 Medium
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreA crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G...7.8 High
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreA file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary...6.7 Medium
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreA crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through...7.8 High
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreAn invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic...6.7 Medium
- apple ipados, ios and ipados, iphone os +2 moreA memory corruption issue was addressed with improved state management. This issue is fixed in...7.8 High
- apple ipados, tvos, watchos +1 more +3 moreA use after free issue was addressed with improved memory management. This issue is fixed in...7.8 High
- apple macos, cups, mac os x +2 more +4 moreA logic issue was addressed with improved state management. This issue is fixed in Security...6.7 Medium
- vim, vim vim/vim, fedoraproject fedora +2 moreHeap-based Buffer Overflow in vim/vim7.1 High
- linux kernel, netapp h300e firmware, h300s firmware +7 more +9 moreA flaw use after free in the Linux kernel pipes functionality was found in the way user do some...7.8 High
- acquia mauticCross-site Scripting vulnerability in Mautic's tracking pixel functionality9.6 Critical
- pmmp pocketmine-mpPocketMine-MP before 4.2.10 Denial of Service via Chat Messages5.3 Medium
- cveproject cve-servicesPotential secrets being logged to disk in CVE Services7.5 High
- friendsofflarum uploadPossible cross-site scripting attack via unsanitized SVG files in FoF Upload8.7 High
- code16 sharpPossible vulnerability at 'npm install' time in sharp if an attacker has control over build environment6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in the Flamingo theme manager7.4 High
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in XWiki Platform Wiki UI Main Wiki7.4 High
- xwiki, xwiki xwiki-platform +1 morePath Traversal in XWiki Platform2.7 Low
- open automation software oas platformAn information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality...7.5 High
- open automation software oas platformAn improper authentication vulnerability exists in the REST API functionality of Open Automation...9.4 Critical
- open automation software oas platformAn external config control vulnerability exists in the OAS Engine SecureAddUser functionality of...7.5 High
- open automation software oas platformA file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open...9.1 Critical
- open automation software oas platformA cleartext transmission of sensitive information vulnerability exists in the OAS Engine...7.5 High
- open automation software oas platformAn information disclosure vulnerability exists in the OAS Engine SecureTransferFiles...4.9 Medium
- open automation software oas platformAn external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality...7.5 High
- open automation software oas platformA denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of...7.5 High
- libjpeg project libjpegIn libjpeg before 1.64, BitStream<false>::Get in bitstream.hpp has an assertion failure that may...6.5 Medium
neos/neosPackagistXSS in various backend modules due to (un)escaping in JS notification moduleNo scorecopy-jdk-configsTuxCareUpdate of copy-jdk-configsNo scoretensorflowPyPI,tensorflow-cpuPyPI,tensorflow-gpuPyPI +2 more`CHECK` failure in depthwise ops via overflowsNo score- tp-link tl-wr840n firmwareTP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console....6.8 Medium
drupal/apigee_edgePackagistThe Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. The developers (user) can view API keys for their respective Apps. The module discloses…No scoredrupal/entity_browser_blockPackagistEntity Browser Block provides a Block Plugin for every Entity Browser on your site. The module didn't sufficiently check entity view access in the block form. This vulnerability is mitigated by the fa…No scoredrupal/embedPackagistThe Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject H…No score- vsourz advanced cf7 db, vsourz digital advanced contact form 7 db (wordpress plugin) +1 moreWordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability4.7 Medium
- truestack direct connectTrueStack Direct Connect 1.4.7 has Incorrect Access Control.9.8 Critical
- gibbonedu gibbonGibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.8.8 High
- docker desktopDocker Desktop 4.3.0 has Incorrect Access Control.8.4 High
- Show moreLoading…